Mati1007
16 Marzec 2013 20:34
#1
Witam podejrzewam infekcję stacjonarki, co chwila zmienia mi się godzina w systemowym zegarze, komputer działa strasznie wolno ( otwieranie programów), przeglądarka tak samo, większość stron się zacina. Oto logi z OTL
http://www.wklej.org/id/983840/
Extras:
http://www.wklej.org/id/983843/
Atis
16 Marzec 2013 20:48
#2
Nie widać infekcji.
Odinstaluj Wincore MediaBar i QuickStores-Toolbar 1.1.0.
Do okna Własne opcje skanowania / skrypt wklej:
:OTL DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\wanatw4.sys – (wanatw) DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EagleXNt.sys – (EagleXNt) DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\Mateusz\USTAWI~1\Temp\catchme.sys – (catchme) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ie … =2&sr=0&q={searchTerms} IE - HKU\S-1-5-21-1417001333-2147097355-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ FF - prefs.js…browser.startup.homepage: “http://search.bearshare.com ” FF - prefs.js…extensions.enabledAddons: quickstores@quickstores.de:1.2.0 FF - prefs.js…extensions.enabledItems: quickstores@quickstores.de:1.2.0 FF - prefs.js…keyword.URL: “http://dts.search-results.com/sr?src=ffb&appid=20&systemid=2&sr=0&q= ” [2011-09-08 15:19:55 | 000,000,000 | —D | M] (Wincore Mediabar) – C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\padcrbpy.default\extensions{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} [2011-02-05 10:31:13 | 000,000,000 | —D | M] (QuickStores-Toolbar) – C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\padcrbpy.default\extensions\quickstores@quickstores.de [2012-11-18 03:41:05 | 000,000,000 | —D | M] (QuickStores-Toolbar) – C:\Program Files\Mozilla Firefox\extensions\quickstores@quickstores.de [2011-09-08 15:19:21 | 000,002,513 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml O2 - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\BrowserConnection.dll (MusicLab, LLC) O2 - BHO: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O3 - HKLM…\Toolbar: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O3 - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O4 - HKLM…\Run: [DATAMNGR] C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC) O4 - HKU\S-1-5-21-1417001333-2147097355-682003330-1003…\Run: [Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray File not found O4 - HKU\S-1-5-21-1417001333-2147097355-682003330-1003…\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe File not found O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) [2011-09-08 17:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dane aplikacji\boost_interprocess [2011-09-12 03:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Henryk\Dane aplikacji\mediabarbs [2011-09-12 03:27:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Henryk\Dane aplikacji\wincorebsband [2012-07-30 11:45:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mateusz\Dane aplikacji\PriceGong [2011-09-20 09:57:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Mateusz\Dane aplikacji\wincorebsband [2011-09-08 15:19:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Ola\Dane aplikacji\mediabarbs [2011-07-05 08:54:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Ola\Dane aplikacji\PriceGong [2011-02-06 15:07:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Ola\Dane aplikacji\QuickStoresToolbar :Files C:\Program Files\BearShare Applications\MediaBar :Commands [emptytemp]
Kliknij Wykonaj skrypt i zatwierdź restart.
Później kliknij Sprzątanie.